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(U) 

The  11  September  Hijacker  Cell  Model 


(U)  EXECUTIVE  SUMMARY 


(U)  Key  Findings 

. --(U) 

The  11  September  hijackers  successfully  eluded  the  notice  of  US  law  enforcement  and 
intelligence  as  they  plotted  to  commandeer  and  use  four  airliners  as  weapons,  but  details  of  their 
lives  and  activities  can  be  used  to  detect  cells  that  may  follow  the  11  September  hijackers’  model. 

It  should  be  noted,  however,  that  the  1993  attack  on  the  World  Trade  Center  and  the  Millennium 
bombing  plot — the  previous  two  major  international  terrorist  operations  on  US  soil — used  tactics 
that  are  different  in  key  respects  from  the  11  September  model,  suggesting  that  future  sleeper  cells 
will  use  a  variety  of  measures  to  conceal  their  activities. 

•  The  1 1  September  hijackers  were  all  Middle  Eastern  men  between  20  and  33  years  of  age 
who  wore  a  western  style  of  dress  and  grooming. 

•  The  hijackers  entered  the  US  legally  and  used  either  their  true  names  or  variations  of  their 
true  names.  Thirteen  of  the  19  hijackers  traveled  to  the  US  in  groups  of  two  or  three— four 
or  the  remaining  six  were  the  pilots. 

•  Once  in  the  country,  the  hijackers  obtained  typical  US  identification — driver  licenses,  state 
identification  cards,  and  commercially  available  documents — likely  in  order  to  avoid  further 
use  of  their  passports. 

•  The  hijackers  changed  residences  frequently. 

•  The  hijackers*  enrollment  at  US  flight  schools  was  not  in  itself  necessarily  uncommon,  but 
their  focus  during  simulation  training  on  learning  only  the  skills  that  would  benefit  their  mission 
distinguished  them  from  typical  students. 

•  The  hijackers  opened  bank  accounts — often  in  pairs — with  money  either  they  brought  legally 
into  the  US  or  wired  from  overseas. 

•  The  hijackers  largely  avoided  associating  with  radical  Islamic  groups  in  the  US,  likely  in  an 
effort  to  reduce  the  chances  of  detection  by  law  enforcement. 

•  The  hijackers*  communications  techniques — face-to-face  meetings,  prepaid  phone  cards,  payphones, 
cell  phones,  the  Internet,  and  possibly  commercially  available  mailboxes — made  it  difficult  to 
trace  their  operational  communications. 
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The  11  September  Hijacker  Cell  Model 


(S//NF)  Al-Qa’ida  leaders  and  key  11  September  plotters  such  as  Usama  Bin  Ladin,  Khalid 
Shaykh  Muhammad  (KSM),  and  Ayman  al-Zawahiri  probably  have  derived  lessons  from  the 
activities  and  experiences  of  the  11  September  hijackers  and  may  be  relying  on  them  to  plan 


future  attacks  against  the  US. 


The  1 1  September  plot  was  at  least  two  years  in  the  making 


(S) 


An  al- 


Qa’ida  operative  calling  himself  “Ubaydah”  claimed  in  a  videotaped  interview  in  June  2002 
that  al-Qa’ida  sent  a  reconnaissance  team  to  the  US  two  years  before  the  1 1  September  operation. 
We  have  no  information  to  confirm  that  this  reconnaissance  operation  occurred  or  that  it  can 
be  tied  to  the  11  September  attacks,  but  it  is  consistent  with  al-Qa’ida  tradecraft  that  calls  for 
long  and  detailed  planning  for  major  operations. 


*  Al-QaMda  has  Lost  its  camps  in  Afghanistan  where  the  plot  was  largely  honed  and 
the  hijackers  were  trained,  but  between  10,000-20,000  potential  terrorists  trained  in 
the  camps  and  al-Qaida’s  networks  in  countries  such  as  Pakistan,  Saudi  Arabia,  and 
Indonesia  leave  it  with  an  ample  pool  of  potential  recruits  for  future  attacks. 


(U)  Snapshot  of  the  Hijackers 

(LES)  Al-Qa’idas$  criteria  in  choosing  the  11  September  hijackers  is  unknown,  but  one  of  the 
most  important  factors  probably  was  their  ability  to  not  arouse  suspicion  from  US  or  foreign 
intelligence  and  law  enforcement  services. 

•  The  hijackers  used  Western-style  clothing  and  grooming  once  in  the  US. 

•  The  hijackers  were  all  Middle  Eastern  men  between  20  and  33  years  of  age.  Many  of  them 
spent  time  in  Afghanistan  in  either  late  1999  or  2000,  according  to  a  variety  of  reporting. 

•  Personal  connections  and  family  ties  among  the  hijackers  also  may  have  been  important; 
among  the  19  were  two  sets  of  brothers — Waled  and  Wa’il  al-Shehri  and  Nawaf  and  Salim  al- 
Hazmi — and  other  sub-groupings  in  which  individuals  appear  to  have  known  each  other  for 
years  before  the  plot. 


(U)  How  They  Entered  the  US 

(LES)  The  hijackers  entered  the  US  legally  on  valid  visas — 15  on  B1  tourist  visas,  three  on  B2 
business  visas,  and  one  on  a  FI  student  visa — using  their  true  names. 


•  Thirteen  of  the  19  hijackers  traveled  to  the  US  in  groups  of  two  or  three — the  four  pilots, 
Mohamed  Atta,  Marwan  al-Shehhi,  Hani  Hanjour,  and  Ziad  Jarrah  are  notable  exceptions. 


(SE^ET//ORCON.NOFORN,X  1 ) 


REQ.  #36-1 


000000026 


Document  obtained  by  INTELWIRE:  Please  credit  and  link  INTELWIRE.com  when  reporting 


( 


•  The  hijackers  arrived  in  the  US  on  eight  different  airlines:  United,  Delta,  Virgin  Atlantic, 
Swiss  Air,  Sabena,  Ceskoslovski  Air,  Condor,  and  Saudi  Airlines.  Their  flights  departed  from 
Brussels,  Frankfort,  London,  Bangkok,  Zurich,  Riyadh,  Paris,  and  Prague,  and  they  arrived  in 
Newark,  Atlanta,  San  Diego,  Orlando,  Miami,  Washington-Dulles,  New  York-JFK,  and  Los 
Angeles. 

•  The  four  pilots  acquired  their  travel  documents— passports  from  Saudi  Arabia,  United  Arab 
Emirate  (UAE),  and  Egypt,  and  visas  issued  in  Jeddah,  Saudi  Arabia;  Dubai,  UAE;  and 
Berlin,  Germany — between  one  and  five  months  before  entering  the  US.  The  other  hijackers 
acquired  their  documents — Saudi  and  UAE  passports  with  visas  issued  mostly  in  Jeddah  and 
Riyadh — from  several  months  to  more  than  a  year  before  entering  the  US 

•  Most  of  the  hijackers  reported  their  previous  passports  as  lost  or  stolen  and  received  new 
ones  that  revealed  no  travel  to  Afghanistan — a  potential  “red  flag”  that  might  have  invited 
scrutiny  even  prior  to  1 1  September. 

(U)  Where  They  Lived  and  What  They  Drove 

(LES)  The  hijackers’  choices  for  living  arrangements  and  cars  were  nondescript  and  likely  would 
not  have  in  themselves  raised  suspicion. 

•  The  hijackers  usually  lived  in  small  groups  of  two  to  five  and  routinely  moved  between  cheap 
motels  and  apartments.  The  pilots  maintained  relatively  stable  residence  during  their  flight 
training,  obtaining  apartments  for  approximately  six  months. 

•  They  owned  four  older  non-descript  vehicles:  Nawaf  al-Hazmi’s  1988  Toyota  Corolla, 
Jarrah’s  1990  Mitsubishi  Eclipse,  Waleed  al-Shehri’s  1993  Dodge  Colt  and  Atta’s  1989 
Pontiac  Gran  Prix.  The  hijackers  also  rented  a  variety  of  vehicles  27  times  from  several  companies, 
including  Enterprise,  Budget,  and  Alamo. 

(U)  Identification  Used 

(LES)  Many  of  the  hijackers  obtained  identification  cards  or  driver  licenses  to  use  instead  of 
their  passports,  which  would  have  called  attention  to  them  as  foreigners. 

•  Eight  hijackers  obtained  driver  licenses  from  Arizona,  California,  and  Florida,  16  obtained 
state  identification  cards  from  Florida  and  Virginia,  and  seven  obtained  commercially  available 
ID  cards.  None  had  social  security  numbers. 

•  At  least  two  hijackers  requested  duplicate  Florida  driver  licenses,  and  both  Atta  and  al-Shehhi 
requested  replacement  pilot  licenses,  leaving  open  the  possibility  that  al-Qa’ida  forgers 
received  the  originals  or  duplicates  and  can  try  to  reproduce  these  items. 
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(LES)  Mohamed  Atta  in  Germany:  His  Conduct  Before  Coming  to  the  US 

(LES)  As  an  expatriate  in  Europe,  Atta  behaved  much  like  the  typical  budding  jihadist.  It  was 
only  after  he  apparently  was  tapped  for  his  mission — perhaps  spotted  and  selected  because  of 
this  behavior — and  returned  from  Afghanistan  that  he  began  observing  strict  operational  security 
practices. 

•  Prior  to  early  February  2000,  Atta  and  his  associates  in  Hamburg — including  1 1  September 
pilots  Marwan  al-Shehhi  and  Ziad  Jarrah — were  known  to  wear  beards  and  Arab-style  dress, 
attended  a  mosque  known  for  extremists  views,  and  openly  associated  with  radical  figures — 
all  acts  that  contradict  recommendations  in  al -Qa'ida  training  manuals  not  to  behave  in  ways 
that  would  attract  law  enforcement  attention. 

•  After  defending  his  thesis  in  October  1999,  Atta  left  for  Afghanistan  and  Pakistan  in  late 
November  and  returned  to  Hamburg  in  late  February  2000,  where  he  no  longer  appeared  to  be 
outwardly  radical,  according  to  law  enforcement  and  intelligence  reporting.  He  did  not  wear 
a  beard  or  Arab-style  dress  and  generally  blended  into  the  Western  world.  Shortly  thereafter, 
Atta  applied  for  a  new  passport — apparently  both  to  disguise  his  travel  to  Afghanistan  and 

to  acquire  a  new  photograph — made  inquires  to  US  flight  schools,  received  a  US  visa,  and 
spread  word  to  family  and  friends  that  he  was  leaving  Germany  to  continue  his  education. 


(U)  Flight  Schools 

(LES)  The  hijackers  enrollment  at  multiple  US  flight  schools  was  not  in  itself  uncommon,  but 
their  focus  on  learning  only  the  skills  that  would  benefit  their  mission — such  as  Atta  and  al- 
Shehhi  requesting  advanced  jet  flight  training  that  focused  on  approaches  and  turns  but  not  on 
take-offs  and  landings — made  them  stand-out. 

•  Between  June  2000  and  September  2001,  Atta,  al-Shehhi,  and  Jarrah  took  flying  classes, 
underwent  flight  simulator  training,  and  flew  test  flights  in  at  least  eight  facilities  in  Florida 
and  Georgia.  Atta  and  al-Shehhi  also  visited  the  Airman  Flight  School  in  Oklahoma. 

•  Hanjour  attended  three  flight  schools  in  Arizona  and  California  between  1996  and  1999. 
After  returning  to  the  US  in  December  2000,  he  took  jet  simulator  lessons  m  Arizona  and 
rented  planes  from  at  least  five  other  facilities  in  Arizona,  New  Jersey,  and  Maryland. 

•  Two  other  hijackers  briefly  took  introductory  flying  lessons  in  San  Diego  in  spring  of  2000, 
but  neither  sought  further  flight  training. 
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(U)  Banking  in  the  US 

(LES)  The  hijackers  financed  their  operation  with  money  electronically  transferred  from  overseas 
as  well  as  with  cash  and  traveler  checks  they  carried — and  declared — when  they  entered  the  US. 
They  opened  US  bank  accounts  and  used  them  legally,  but  they  favored  an  unusual  practice  of 
sharing  accounts  between  unrelated  members.  None  of  the  hijackers  worked  to  supplement  this 
funding. 


•  The  hijackers,  often  in  pairs,  used  24  bank  accounts  from  branch  banks  belonging  to  Sun 
Trust,  Hudson  United,  First  Union,  Bank  of  America,  and  Dime  Savings. 

•  As  the  operation  drew  near,  the  hijackers  closed  the  majority  of  their  bank  accounts  and  wired 
most  of  the  remaining  money  overseas  through  Western  Union  stations  at  bus  terminals  and 
grocery  stores. 

(U)  How  They  Communicated 

(LES)  The  hijackers  favored  communications  techniques  designed  to  make  operational  discussions 
difficult  to  trace. 

•  They  used  pre-paid  calling  cards  combined  with  payphones  to  make  operational  telephone 
calls  to  conspirators  in  the  US  as  well  as  the  Middle  East  and  Germany,  according  to  law 
enforcement  information.  They  used  cell  phones  to  receive  operational  calls. 

•  They  apparently  reserved  their  most  sensitive  planning  discussions  for  face-to-face  meetings, 
which  likely  were  held  three  times  in  2001;  Germany  in  January,  Spain  in  July,  and  Las  Vegas 
in  mid-August. 

•  At  least  nine  hijackers  used  post  office  mailboxes  from  such  places  as  Mail  Boxes  Etc  and 
Mail  Depot,  possibly  to  receive  regular  mail  and  to  help  establish  residence. 

(U)  Businesses  They  Frequented 

(LES)  Besides  rental  car  businesses  and  commercially  available  post  office  boxes,  the  hijackers 
also  frequented  several  other  businesses. 

•  Many  of  the  hijackers  worked  out  at  gyms — possibly  to  help  prepare  them  for  subduing  passengers 
in  taking  over  the  airliners. 

•  They  used  Kinkos  for  photocopying  unknown  materials  and  for  computer  rentals. 

•  Marwan  al-Shehhi  also  visited  several  bars  during  his  stay  in  the  US  and  along  with  Hamza 
al-Gamdi  twice  in  July  2001  purchased  a  large  amount  of  pornography — $250,  and  $183 
worth — from  a  Video  Outlet  store  in  Florida. 
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(LES)  While  the  hijackers  made  a  special  effort  to  blend  in  and  conceal  their  jihadist  zeal,  this 
mask  cracked  in  the  closing  days  of  their  mission. 

•  A  maid  at  the  Days  Inn  in  Boston  where  the  Flight  175  hijackers  stayed  the  night  before  the 
attack  reported  finding  a  large  amount  of  body  hair  in  the  room,  all  of  the  rooms’  lotion  used — 
possibly  to  aid  the  shaving — and  that  they  had  only  slept  on  top  of  their  beds. 

•  Copies  of  the  same  letter  were  recovered  from  the  hijackers  belongings  that  detailed  steps  and 
prayers  that  were,  to  be  followed  before  the  attacks. 
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(LES)  Annex  A:  Ramzi  Yousefs  and  the  11  September  Hijackers’  Operational  Tradecraft 

(LES)  There  are  some  similarities  between  the  1993  World  Trade  Center  (WTC)  bombers  led  by 
Ramzi  Yousef  and  the  11  September  hijackers,  but  there  also  are  key  differences  that  make  it  difficult 
to  establish  a  single  pattern  that  sleeper  cells  in  the  US  likely  would  follow. 

(LES)  Key  operational  characteristics  common  to  the  1993  and  2001  plotters  include: 

•  Some  of  the  conspirators  from  both  plots  arrived  in  the  US  at  least  six  months  prior  to  the 
attacks — in  some  cases,  more  than  a  year — and  members  focused  their  time  and  energy  in 
preparing  for  the  attacks. 

•  Some  members  of  each  plot  used  shared  bank  accounts. 

•  The  key  leaders  of  both  plots — Yousef  and  the  1 1  September  pilots — shared  a  variety  of  personal 
characteristics.  They  had  broad  exposure  to  the  West — Yousef  and  three  of  the  four  pilots 
studied  in  Western  Europe  and  had  technical  backgrounds — spoke  workable  English,  were  in 
their  20s  or  early  30s,  and  hailed  from  affluent  families. 

(LES)  Key  operational  differences  include: 

•  Yousef  and  co-conspirator  Mohammed  Ajaj  traveled  together  from  Pakistan  and  used  false 
names  and  documents  to  enter  to  the  US,  while  all  19  hijackers  used  their  true  names,  legitimate 
passports,  and  secured  visas  to  enter  the  country. 

•  Yousef  used  at  least  four  passports  and  three  different  names  to  enter,  operate,  and  exit  the 
US,  while  the  hijackers  acquired  legitimate  forms  of  identification,  such  as  driver’s  licenses 
and  state  identification  cards  in  their  true  name. 

•  Yousef  relied  on  a  local  network  of  childhood  friends  and  individuals  introduced  to  him  by 
others  after  his  arrival  in  the  US  to  carry  out  his  attack.  Most  had  no  significant  training  and 
indoctrination,  and  one  conspirator  was  brought  into  the  plot  two  weeks  before  the  attack. 
Conversely,  the  hijackers  relied  mainly  on  experienced,  well-trained  manpower  from  abroad 
and  did  not  bring  unknown  individuals  into  their  plot  after  arriving  in  the  US. 

•  The  1993  conspirators  frequently  made  overseas  phone  calls  from  their  residences,  while 
the  hijackers  relied  on  prepaid  cell  phones,  calling  cards,  and  Internet  cafes  to  communicate 
abroad.  Yousef  had  a  personal  computer,  but  the  hijackers  are  not  known  to  have  owned  laptop 
or  desktop  computers  or  any  electronic  data  storage  media. 
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(LES)  Annex  B:  Ahmed  Ressam  and  the  11  September  Hijackers*  Tactics  in  the  US:  More 
Contrasts  in  Tradecraft 

(LES)  There  are  few  similarities  between  the  Millennium  bomber  Ahmed  Ressam  and  his  plot  to 
attack  Los  Angeles  airport  and  the  11  September  hijackers. 

•  Ressam’s  identification  documents — including  passports,  visas,  driver  licenses,  social  security 
numbers,  and  credit  cards — were  all  fraudulently  obtained  in  contrast  to  the  1 1  September 
hijackers  exclusive  use  of  legitimate  documentation. 

•  Ressam  applied  for  and  was  granted  political  asylum  in  Canada  in  1994,  inviting  increased 
scrutiny  by  Canadian  immigration  authorities.  The  1 1  September  plotters  sought  no  special 
immigration  status. 

•  Although  Ressam  had  lived  in  Canada  since  1994,  his  English  language  abilities  were  poor, 
probably  a  result  of  living  in  a  predominantly  Algerian  community.  The  11  September  pilots 
all  spoke  workable  English. 

•  In  contrast  to  the  1 1  September  hijackers,  neither  Ressam  nor  his  associate,  Abdelmajid 
Dahoumane,  conducted  surveillance  or  route  rehearsals  to  the  US,  other  than  with  a  map. 

•  In  his  debriefings,  Ressam  has  indicated  that  his  cell  was  instructed  to  engage  in  criminal 
behavior  such  as  credit  card  fraud  and  petty  theft,  to  finance  their  terrorist-related  activities; 
Ressam  was  arrested  for  theft  four  times  in  only  a  few  years.  The  1 1  September  hijackers 
used  legitimate  US  bank  accounts  and  either  legally  brought  money  to  the  US  or  had  it  electronically 
sent  from  the  Middle  East  to  their  accounts. 

•  Like  the  1 1  September  hijackers,  Ressam  practiced  operational  security  in  communicating 
with  his  associates,  although  not  as  well.  Ressam  used  multiple  pre-paid  calling  cards  and 
several  different  pay  phones,  but  used  a  cellular  phone  to  leave  messages  at  the  local  mosque 
for  associates  to  meet  him  there. 
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(U)  Annex  C:  List  of  Hijackers  and  Planes 


American  Airlines  Flight  11 

Departed  Boston — Crashed  into  the  north  tower  of  the  World  Trade  Center 
76  passengers  and  1 1  crew 

Mohamed  Atta 
Satam  al-Suqami 
Waled  al-Shehri 
Wa’il  al-Shehri 
Abdulaziz  al-Omari 

United  Airlines  Flight  175 

Departed  Boston — Crashed  into  the  south  tower  of  the  World  Trade  Center 
5 1  passengers  and  nine  crew 

Marwan  al-Shehhi 
Fayez  Banihammad 
Ahmed  al-Ghamdi 
Hamza  al-Gamdi 
Mohand  al-Shehri 

American  Airlines  Flight  77 

Departed  Washington  Dulles — Crashed  into  the  Pentagon 
53  passengers  and  six  crew 

Hani  Hanjour 
Khalid  al-Mihdhar 
Majed  Moqed 
Nawaf  al-Hazmi 
Salem  al-Hazmi 

United  Airlines  Flight  93 

Departed  Newark — Crashed  near  Stony  Creek  Township,  Pennsylvania 
33  passengers  and  seven  crew 

Ziad  Jarrah 

Saeed  al-Ghamdi  ' 

Ahmed  al-Haznawi 
Ahmed  al-Nami 
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